QwikSec

Security Database

CVE

CWE

Training

CVE-2025-34238

Published: Nov 6, 2025

Modified: Nov 17, 2025

PUBLISHED

Description

Advantech WebAccess/VPN versions prior to 1.1.5 contain an absolute path traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileAction() that allows an authenticated network administrator to cause the application to read and return the contents of arbitrary files the web user (www-data) can access.

Vendor	Product	Versions
Advantech	WebAccess/VPN	affected `0 - < 1.1.5`

Weaknesses (CWE)

References

https://icr.advantech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf

vendor-advisory

patch

https://www.vulncheck.com/advisories/advantech-webaccess-vpn-path-traversal-via-ajaxstandalonevpnclientscontroller

third-party-advisory

https://icr.advantech.com/download/software

product

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.